Kungani iseva engemuva kweklayenti ye-VPN iphendula ngomhubhe

Ukuxhumana okungenayo ku-host esebenza neklayenti ye-VPN kuyehluleka ngendlela ethile kakhulu: ukuxhawulana kufika, i-daemon iyaphendula, futhi iklayenti alitholi lutho emuva. Akukho okuvimbela iphothi. Impendulo iphume ngomhubhe, ngoba umhubhe uphethe umzila ozenzakalelayo futhi i-kernel ihambisa izimpendulo ngokwendawo ekuyiwa kuyo, hhayi ngokukhumbula ukuthi isicelo savela kuphi. Lokho kwephulwa okukodwa kuchaza zonke izimpawu ezilandelayo.

Impendulo ihambiswa, ayikhunjulwa

Iklayenti ye-VPN efaka umzila ozenzakalelayo yengeza umbhalo odlula isango le-LAN, kungaba nge-metric noma ngokuhlukanisa isikhala sibe izingxenye ezimbili ezicacile. Amaphakethe aphumayo manje akhetha i-interface yomhubhe. I-kernel ayikaze ibuze ukuthi iphakethe eliphendulwayo lafika kuphi ekuqaleni. Lokho kwephulwa okukodwa kuchaza zonke izimpawu ezilandelayo.

Indlela eya phambili ihambiswa ngokwendawo ekuyiwa kuyo, futhi neyokubuya. Impendulo iqondiswe kuklayenti lomphakathi, umhubhe ozoyithwala ngokuzimisela. Umkhawulo okude uthola iphakethe elinganayo nomthombo walo, liyaliphonsa, futhi iklayenti lokuqala lilinda kuze kuphele isikhathi.

Ukuhlunga okuqinile komzila wokubuya kungase kulahle iphakethe elingenayo ngaphambi kokuba i-daemon ilifunde. Hlola leso sibalo kuqala, ngoba ukulahleka kwesihlungi kanye nephutha lokuhambisa kubonakala kufana ngaphandle.

ip route show default
sysctl net.ipv4.conf.all.rp_filter net.ipv4.conf.eth0.rp_filter
nft list ruleset | grep -A3 'hook forward'

Umyalo wokuqala ukhombisa ukuthi imuphi umzila ozenzakalelayo onqobayo manje. Owesibili ubika ukuthi ukuhlunga okuqinile kusebenza emhlabeni wonke noma nge-interface ngayinye, futhi owesithathu ukhombisa noma yimuphi umthetho wochungechunge lokudlulisa ongase ube khona.

Izindlela ezintathu zokugcina umzila wokubuyela

Ukukhipha indawo ekuyiwa kuyo yesevisi emhubheni iyindlela emincane kakhulu. Umzila we-host oqondiswe esangweni le-LAN, kanye ne-daemon eboshwe ekhelini lomzimba esikhundleni sawo wonke amakheli, kugcina lokho kugeleza okukodwa ngaphandle komhubhe. Ushintsho lwasekhaya futhi kulula ukuluhoxisa.

I-policy routing iyimpendulo evamile. Umthetho okhiyeleke kukheli lomthombo noma kuphawu lwe-firewall ukhetha ithebula umzila walo ozenzakalelayo okhonza esangweni le-WAN, kuyilapho ukuxhumana kwe-host ngokwakho kuqhubeka kusebenzisa umhubhe. Gcina ukubaluleka kucace ukuze umthetho ungase ufihlakale kamuva.

ip rule add from 203.0.113.25/32 table 100 priority 100
ip route add default via 192.0.2.1 dev eth0 table 100
ip route get 198.51.100.7 from 203.0.113.25

Imiyalo emibili yokuqala yakha umzila ohlukile wezimpendulo ezinomthombo okhelini lomphakathi. Owesithathu ubuza i-kernel ukuthi yimuphi umzila umthombo nendawo ekuyiwa kuyo kanye kanye abazowuthatha, futhi yileyondlela eqinisekisa ukuthi umthetho unomthelela othile.

Ukuhunyushwa komthombo kuyindlela yesithathu futhi iwukuphela kwendlela esinda phambi kwe-router esivele yenza i-NAT phambi kwesevisi. Impendulo kufanele ibuyele kuleyo router, futhi ukufihla ikheli kuya ku-interface ye-WAN kukufeza lokho kuyilapho kufihla iklayenti kumarekhodi esevisi. Ukushintsha umzila ozenzakalelayo ngesandla ngemuva kokuxhuma kuwukuxilonga, ngoba iklayenti libhala kabusha ithebula ekuxhumekeni okulandelayo.

Lapho ibhokisi lihambisa futhi i-LAN

Ukwehluleka okufanayo kuvela ngokugxuma okukodwa kude lapho i-host ihambisa izingxenye ezingemuva kwayo. Ukuxhumana okungenayo kudluliselwa kudivayisi yangaphakathi umzila wayo wokubuyela okuwukuphela kwawo umhubhe, futhi impendulo ifinyelela iklayenti langaphandle kusukela ekhelini lomhlinzeki. Idivayisi yangaphakathi isebenza kahle isikhathi sonke.

Khona-ke ukulandelela ukuxhumana kubona impendulo yokugeleza engakaze ikubhale futhi iyilahle. Ukuhunyushwa kwendawo ekuyiwa kuyo kuletha ukuxhumana okungenayo kudivayisi, futhi ukuhunyushwa komthombo kwenza impendulo ibonakale sengathi ivela ku-router uqobo.

Umzila wenqubomgomo ogcina iphothi elidlulisiwe ku-WAN kuyilapho ithrafikhi ye-router uqobo isebenzisa umhubhe uyisilinganiso esihlanzekile. Ngaphandle kokuhunyushwa komthombo impendulo iqondiswe kuklayenti langaphandle, futhi idivayisi yangaphakathi ayinawo nomzila wokuya kulelo kheli.

Izivivinyo ezintathu ezihlukanisa izimbangela

Yenza izivivinyo ezintathu: ukuxhumana okungena ebhokisini kusuka ku-internet, ukuxhumana okuphuma kulo kuya ku-host yomphakathi, kanye nokusesha igama. Lapho ezimbili zokuqala zingavumelani, umzila wokubuyela unecala. Lapho amagama ehluleka kuzo zombili izindawo, isixazululi enye iphutha elihlanganyela umhubhe kuphela.

Lungisa kuqala umbuzo wokuhambisa, bese ubheka amagama. Ukuhlanganisa kokubili yiyo indlela iseva esebenzayo esolwa ngayo ngesixazululi esiphukile.

Bhala ukuthi iyiphi i-interface ekhonjwa umkhipho futhi gcina ukulungiselelwa ngaphansi kokulawulwa kwenguqulo. Umthetho obhalwe ngokumelene ne-interface eqanjwa kabusha ngemuva kokuthuthukiswa uyadlula namuhla futhi uyehluleka ngemuva kokuqalisa kabusha okulandelayo.